{"record":{"id":"e7e87f24ea0af8e7","repo":"OpenNHP/opennhp","slug":"ztdo-output-data-private-key-and-provide","errorCode":null,"errorMessage":"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode","messagePattern":"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":88,"sourceCode":"\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode\n\t\t\t\tif c.String(\"ztdo\") != \"\" || c.String(\"data-private-key\") != \"\" || c.String(\"provider-public-key\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else if c.String(\"mode\") == \"decrypt\" {\n\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"smart-policy\") != \"\" || c.String(\"access-url\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--source, --smart-policy and --access-url are only allowed in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in encrypt mode\n\t\t\t\tif c.String(\"ztdo\") == \"\" || c.String(\"output\") == \"\" || c.String(\"data-private-key\") == \"\" || c.String(\"provider-public-key\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\tmode := c.String(\"mode\")\n\t\t\tsource := c.String(\"source\")\n\t\t\tdsType := c.String(\"data-source-type\")\n\t\t\tsmartPolicy := c.String(\"smart-policy\")\n\t\t\tmetadata := c.String(\"metadata\")\n\t\t\toutput := c.String(\"output\")\n\t\t\tztdo := c.String(\"ztdo\")\n\t\t\tztdoId := c.String(\"ztdo-id\")\n\t\t\tdataPrivateKey := c.String(\"data-private-key\")\n\t\t\taccessUrl := c.String(\"access-url\")","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L70-L106","documentation":"Decrypt mode requires all four of --ztdo (the encrypted ZTDO file), --output (decrypted file path), --data-private-key and --provider-public-key (base64 keys). The Before hook fires this error when any one of them is an empty string, since partial credentials can never decrypt a ZTDO.","triggerScenarios":"`nhp-device run --mode decrypt ...` missing any of --ztdo, --output, --data-private-key or --provider-public-key.","commonSituations":"Keys not yet provisioned in the environment; forgetting --output because it was also required in encrypt mode and assumed optional; a typo'd flag name leaving the real one empty; testing decrypt before exporting provider public key.","solutions":["Supply all four flags: --ztdo <file>, --output <file>, --data-private-key <base64>, --provider-public-key <base64>","Generate/load keys with `nhp-device keygen` and export the provider public key from the data provider","Echo the values in the script before invoking to confirm none expand to empty"],"exampleFix":"// before\nnhp-device run --mode decrypt --ztdo a.ztdo --data-private-key K\n// after\nnhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P","handlingStrategy":"validation","validationCode":"const required = ['ztdo','output','data-private-key','provider-public-key'];\nif (flags.mode === 'decrypt') {\n  const missing = required.filter(f => !flags[f]);\n  if (missing.length) throw new Error('decrypt mode missing: ' + missing.join(', '));\n}","typeGuard":"const isDecryptReady = (flags) => ['ztdo','output','data-private-key','provider-public-key'].every(f => Boolean(flags[f]));","tryCatchPattern":null,"preventionTips":["Store the base64 keys in a secret store and inject them explicitly","Echo/verify all four values are non-empty before invoking","Keep the ZTDO file path and output path distinct and verified"],"tags":["cli","validation","flags"],"backgroundTag":"missing-required-flag","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}